=== Ensomedia Security changelog, 1.0.0 to 1.1.9 ===

The changes since 1.1.10 are in readme.txt.

= 1.1.9 =
* Unused plugins can be deleted from their finding: tick the ones to remove (all are ticked) and confirm. It works like Delete on the Plugins screen, so each plugin's own uninstall runs. Only plugins in use nowhere are listed, never ShieldWave itself, and only for users who may delete plugins on a server where WordPress can write the files.
* On a multisite network, a plugin switched on for one site only is no longer reported as unused.
* Files that an older WordPress release left behind after an update are no longer reported as unknown PHP. Each one matches the checksums of the release it comes from; the check's summary counts them and nothing needs to be done. A PHP file that no release explains is still reported.
* Fewer false alarms on premium plugins: the storage index files All-in-One WP Migration writes itself, the html2canvas library in Elementor Pro, a base64 image saved with wp_upload_bits(), and $GLOBALS read with a fixed key as in BerlinDB (WP Rocket and others) and ACF Pro.
* An empty debug.log is not reported. A debug log the server refuses to hand out is a low note instead of a high finding; only a log that can really be downloaded stays high.
* A site that works over HTTPS but has http:// in Settings > General gets a low note instead of "Login and dashboard are not served over HTTPS".
* With TranslatePress active, findings no longer show its #!trpst# markers, and texts follow the language of the admin instead of the site.
* A new rule finds the cmd.exec remote-control backdoor family as critical, also outside the uploads folder. Every file is analysed again under the new rules.
* In the network admin the texts say "network" where a single site says "site".
* More room in the layout: a wider side margin, a calmer header with smaller tabs, a smaller headline and more space between sections. WordPress notices above the plugin are readable in dark mode.

= 1.1.8 =
* A scan no longer stops with an error on hosting whose PHP is built without the tokenizer extension (rare; it is on by default almost everywhere). Without it the malware rules match the raw text, as before 1.1.7.

= 1.1.7 =
* A finding about files now says where they are: "in the plugin X 2.3.0 (inactive)", "in the theme Y", "in WordPress's own files" or "in the uploads folder", and the advice fits that place. An inactive plugin is to be deleted, a plugin from WordPress.org reinstalled, a premium one replaced with a fresh copy from its author, a WordPress file reinstalled from Dashboard > Updates. The same goes into the email alert and into "Copy for your developer".
* Every finding has "Read more": a fuller explanation for a developer, where the file comes from, the steps with WP-CLI commands and how to check the fix worked, with a button that copies all of it. The plain message above stays as it was.
* An old copy of ShieldWave Security (2.x or 3.x) left in the plugins folder is no longer reported as malware. Its scanner lists the names of known webshells as text to look for, which read like a webshell. Code-pattern rules now count only where the pattern is code, not inside a string or a translated sentence; real backdoors are still found.
* After a scan, the Overview asks once whether to turn on live protection, with a link to what is sent. "Not now" hides it for 30 days. Nothing is turned on without the click.
* Translations shipped with the plugin now win over an older language pack from translate.wordpress.org, which only fills what the plugin lacks. On Polish sites some sentences showed in English and corrected wording never appeared.
* An empty threat feed says that it has nothing beyond the built-in rules yet, instead of showing three zeros.
* Many screen fixes: the layout is centred on wide screens, titles wrap instead of being cut off, form fields and the selected option read clearly in dark mode, notices above the plugin follow its theme, commands and settings fit a phone, the settings section list stays in view and marks the right section, changed settings that are not saved yet are marked and leaving asks first, no glow under buttons, and one-letter words no longer end a Polish line.
* The link to this site on shieldwave.io opens "My sites".

= 1.1.6 =
* On a multisite network the ShieldWave screens are styled again. In the network admin WordPress names the screen differently from a single site, so the plugin did not recognise its own screens there: the stylesheet did not apply (plain lists, tiny text), History and Settings opened as the Overview, and the footer line was missing.
* WordPress itself is no longer reported as vulnerable for two old records that match every version and that WordPress has never fixed (a blind server-side request through pingbacks and activation keys stored in plain text). An up-to-date site was told "WordPress has 2 known vulnerabilities" and to wait for a fix that is not coming. A real vulnerability in WordPress is still reported with the release that fixes it.
* A WordPress release that WordPress.org marks as insecure is reported with the secure release of its branch, even before the vulnerability databases have a record for the fix.
* A vulnerability in WordPress itself with no fixed release no longer offers the Plugins screen.

= 1.1.5 =
* The site and shieldwave.io agree on a language. When the site connects, the plugin tells shieldwave.io the site's language; an account that has not chosen one yet takes it over, so the emails, reports and dashboard of shieldwave.io come in the language the site already uses. The account's language is shown next to the account under Settings and follows a change made in the dashboard within the hour.

= 1.1.4 =
* Known-vulnerability checks and the threat feed now run every hour instead of every three, so a vulnerability disclosed for one of your plugins or themes is reported, and emailed if alerts are on, within the hour. The lookups are cached on shieldwave.io, so the extra runs cost your site almost nothing. An existing schedule is moved to the new rhythm on update.

= 1.1.3 =
* A plain image in the uploads folder is no longer reported as an unknown PHP file. With "Images" switched on in Extra checks, every picture was listed as a high finding (a shop with 200 product photos saw all 200), and the email alert went out for them. An image is now reported only when ShieldWave actually finds PHP code inside it, which it still does.

= 1.1.2 =
* The screens keep the size of the WordPress admin on large monitors. Since 1.0.3 the whole plugin was enlarged on windows wider than 1920 pixels (a third bigger at 2560); now a wider window gives the lists more room instead of bigger letters. Only a 4K window at 100% scaling gets one small step up.
* The header, the status band, the lists and the footer share one left and right edge, and the light under the current tab sits exactly on the header's bottom line.
* A tidier header: a slightly lower headline, the theme switch and Scan now in the same rounded shape.
* More bot traffic in the simulation on the planet, most of it aimed at your site, also when the system asks for less motion.

= 1.1.1 =
* The automatic scan stays on the hour you chose. It kept its old clock time after the clocks changed or after you picked another time zone under Settings > General, so "At 03:00" could sit beside "Next scan at 02:00". Every run now plans the next one from your site's own time. On the one day the clocks skip the chosen hour, the scan runs right after it; when an hour happens twice, it runs once, the first time.
* The update replaces the schedule of 1.1.0 at once, and nothing is scheduled twice.
* The weekly summary follows your site's clock in the same way.
* The hours in the list under "At" use your site's time format, the same as "Next scan", and "today" and "tomorrow" are right on the days the clocks change.
* "See plans" opens the pricing page with the Pro plan selected.
* After a scan, the Overview shows one plain line about the free outside check at shieldwave.io, with your domain filled in. There is nothing to dismiss, and nothing is sent unless you click it.
* Every link from the plugin to shieldwave.io carries the tags utm_source=wordpress, utm_medium=plugin and utm_campaign=(the screen the link is on), which tell shieldwave.io only which link a visit came from.

= 1.1.0 =
* Connect with shieldwave.io in one click, from Settings or the Overview: sign in or create a free account there, press "Connect this site" and you are back. Pasting an API key still works, under "Use an API key instead".
* A free shieldwave.io account shows one site in the dashboard, with its score and open problems.
* While connected, shieldwave.io confirms that the domain is yours from an invisible tag on the home page, so its full outside scan can run on the site.
* Disconnecting removes the site and its results from shieldwave.io, and a copy of the site at another address (a staging copy) shows as a site of its own.
* The dashboard shows the AI second opinion on a file, and problems you ignored as ignored.
* Known vulnerabilities: plugins whose folder name has capital letters are matched again, and one plugin the lookup cannot read no longer stops the check for all the others.
* The old ShieldWave Security from shieldwave.io and this plugin can be installed side by side without losing anything: deactivating or deleting one leaves the settings, results, schedule and two-factor set-ups of the other alone, and a notice says how to remove the old copy.
* Problems about administrator accounts are sent to the dashboard without the account names, and the texts about what is sent say exactly that.
* "Turn all of it on" beside Live protection on the Overview works without JavaScript too.

= 1.0.3 =
* A clearer Overview: every group of problems has its own heading above its list, a row shows the name of the problem, and everything else opens with a click.
* The tabs in the header are easier to see, and the Settings tab shows how many protections are still off.
* The look of shieldwave.io: its colours, and its planet beside the status of your site. The planet marks where your site is and shows a simulation of typical bot traffic; a button beside it stops the motion.
* The screens grow with the window on large monitors, and buttons are easier to hit on phones.
* "New" marks a problem only when some problems are new and others are not.
* When a problem has no WordPress screen to open, "Copy for your developer" is the main button.
* No request for a review while something urgent is open.
* "Turn on" beside Known vulnerabilities opens the right part of Settings, and the time of an AI second opinion no longer says "ago" twice.
* In the dark theme the hour of the automatic scan stays readable while its list is open, and switches that are off have a visible edge.

= 1.0.2 =
* Emails display correctly in Outlook on Windows: the button keeps its padding, the fonts stay the same in every part of the message, and a long file path wraps instead of widening the message.
* The ShieldWave mark in emails is in the brand colour, so it shows in Outlook's dark mode too.

= 1.0.1 =
* Translated into Arabic, Chinese (Simplified), Dutch, French, German, Indonesian, Italian, Japanese, Korean, Polish, Portuguese (Brazil), Russian, Spanish, Swedish, Turkish and Vietnamese.
* Right-to-left layout for Arabic and other right-to-left admin languages.
* The ShieldWave mark in the plugin's header and admin menu, the same as on shieldwave.io.
* Alert emails carry the ShieldWave mark (embedded in the email, nothing is loaded from outside), a clearer layout and a right-to-left layout for Arabic.
* After a few scans, the Overview asks once whether you would review the plugin on WordPress.org. "Later" and "Do not ask again" are remembered per administrator.

= 1.0.0 =
* First release in the WordPress.org directory.
* Builds downloaded earlier from shieldwave.io were numbered up to 3.6.6. To switch, deactivate and delete that copy, then install this one; the first scan starts the file history again.
